CVE-2026-92753 describes an authorization bypass vulnerability in PatrowlManager through version 1.8.4. The vulnerability exists in the events and alerts API endpoints, which do not enforce ownership filtering. As a result, authenticated attackers with limited privileges can read platform event history, delete arbitrary events, and modify alerts that belong to other users, violating access control policies.

The vulnerability enables authenticated users to bypass authorization controls, leading to unauthorized disclosure, modification, and deletion of event and alert data belonging to other users. This can compromise the integrity and confidentiality of platform event history and alert configurations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoints to trusted users only and monitor for suspicious activity related to event and alert management.